> ## Documentation Index > Fetch the complete documentation index at: https://docs.yativo.com/llms.txt > Use this file to discover all available pages before exploring further. # Regenerate Webhook Secret > Issue a new signing secret for an existing webhook endpoint Regenerate the HMAC signing secret for a webhook. Use this after a secret is suspected to be compromised, or as part of a routine secret rotation policy. ``` POST https://api.yativo.com/api/v1/business/webhook/{webhook_id}/regenerate-secret ``` > [!NOTE] > > Requires `Idempotency-Key` header. After regeneration, update `YATIVO_WEBHOOK_SECRET` in your environment immediately — the old secret stops working right away. ```bash cURL theme={null} curl -X POST 'https://api.yativo.com/api/v1/business/webhook/wh-01abc123/regenerate-secret' \ -H 'X-Api-Key: YOUR_API_KEY' \ -H 'X-Api-Secret: YOUR_API_SECRET' \ -H 'Idempotency-Key: regen-secret-001' ``` ```javascript Node.js theme={null} const response = await fetch( `https://api.yativo.com/api/v1/business/webhook/${webhookId}/regenerate-secret`, { method: 'POST', headers: { 'X-Api-Key': process.env.YATIVO_API_KEY, 'X-Api-Secret': process.env.YATIVO_API_SECRET, 'Idempotency-Key': `regen-${Date.now()}`, }, } ); const data = await response.json(); // Update your environment with data.data.secret immediately ``` ```json Success theme={null} { "status": "success", "status_code": 200, "message": "Webhook secret regenerated successfully", "data": { "webhook_id": "wh-01abc123", "secret": "whsec_newb2c3d4e5f6...", "updated_at": "2026-06-01T10:00:00.000000Z" } } ``` > [!WARNING] > > The new secret is shown only once — store it securely immediately. The old secret is invalidated as soon as the new one is issued. ## OpenAPI ````yaml openapi-fiat.yaml POST /business/webhook/{webhook_id}/regenerate-secret openapi: 3.0.3 info: title: Yativo Fiat API description: > The Yativo Fiat API enables businesses to manage customers, run KYC/KYB, send and receive cross-border payments, issue virtual accounts and virtual cards, manage beneficiaries, and more. **Base URLs** | Environment | URL | |---|---| | Production | `https://api.yativo.com/api/v1` | | Sandbox | `https://smtp.yativo.com/api/v1` | **Authentication** Send `X-Api-Key` and `X-Api-Secret` on every request. Create keys in the dashboard under **Developers → API Keys**. Each key only works from the server IPs listed on it (enforced since 14 October 2026). Keys don't expire and there's no login call or token refresh. Login tokens (`POST /auth/login` with an Account ID and App Secret, and `Authorization: Bearer`) have been discontinued and don't work for API requests. Endpoints that change how a person signs in (passkeys, two-factor authentication, PIN) or delete the account can't be called with an API key. Use the dashboard for those. API keys and IP whitelists can only be managed in the dashboard. **Rate limits** Per business account: 20 writes (`POST`, `PUT`, `PATCH`, `DELETE`) and 50 reads (`GET`) a second. Some plans set their own limit. Enterprise plans have no general limit. **Idempotency** Send an `Idempotency-Key` header on every `POST`, `PUT`, `PATCH` and `DELETE` request. A retry with the same key and body within 60 minutes returns the original response without running again. Reusing a key with a different body returns `409`. **KYC endpoints** are hosted on a separate platform at `https://kyc.yativo.com`. They are documented here for completeness but use that base URL, not the main API base. version: 1.0.0 contact: name: Yativo Support url: https://yativo.com servers: - url: https://api.yativo.com/api/v1 description: Production - url: https://smtp.yativo.com/api/v1 description: Sandbox security: - apiKey: [] apiSecret: [] tags: - name: Customers description: Create and manage customer profiles. - name: KYC / KYB description: > Identity verification for individual customers (KYC) and business customers (KYB). Submission endpoints are on `https://kyc.yativo.com/api`. - name: KYC Lookups description: > Lists your KYC and KYB forms need: countries, subdivisions, postal code formats, ID types, occupations, industries and allowed values. Served from `https://kyc.yativo.com/api`. - name: Payments & Transfers description: Exchange rates, quotes, send money, payout methods, and wallet payouts. - name: Deposits description: Initiate and retrieve payin deposits. - name: Virtual Accounts description: Issue and manage virtual bank accounts for customers. - name: Wallets description: View balances, create wallets, and list wallet payouts. - name: Beneficiaries description: Manage saved recipients and their payment methods. - name: Transactions description: List, retrieve, track, and download receipts for all transaction types. - name: Virtual Cards description: Activate, issue, manage, and terminate prepaid virtual cards. - name: Payouts description: Single and batch payouts to beneficiaries. - name: Currency Swap description: Swap balance between your own currency wallets. - name: IP Whitelist description: Check whether your server's IP can use your API key. - name: Account Security description: Review sign-in activity on your account. - name: Corporate Card Links description: >- Each corporate card's employee-only page for card details and PIN, employee card sign-in, and branding. - name: Webhooks description: Register and manage webhook endpoints for real-time event notifications. - name: Developer description: Request logs and webhook event inspection. paths: /business/webhook/{webhook_id}/regenerate-secret: post: tags: - Webhooks summary: Regenerate Webhook Secret description: > Issue a new HMAC signing secret for an existing webhook. The old secret is invalidated immediately — update `YATIVO_WEBHOOK_SECRET` in your environment right away. The new secret is shown only once. Requires an `Idempotency-Key` header. parameters: - name: webhook_id in: path required: true schema: type: string description: The ID of the webhook whose secret you want to regenerate. - $ref: '#/components/parameters/IdempotencyKey' responses: '200': description: New secret issued content: application/json: schema: type: object properties: status: type: string status_code: type: integer message: type: string data: type: object properties: webhook_id: type: string secret: type: string description: New HMAC secret. Shown once only. updated_at: type: string format: date-time components: parameters: IdempotencyKey: name: Idempotency-Key in: header required: true schema: type: string description: A unique string per request to ensure idempotent processing. securitySchemes: apiKey: type: apiKey in: header name: X-Api-Key description: >- Your API key (`yativo_pk_...`) from Developers → API Keys. Send together with X-Api-Secret. apiSecret: type: apiKey in: header name: X-Api-Secret description: Your API secret (`yativo_sk_...`), shown once when the key is created. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.